Insecure Deserialization (ARCH5109)

Key go.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Feeding untrusted data into type-aware deserializers like encoding/gob lets an attacker inject unexpected types and forms a classic remote-code-execution vector.

Incorrect

dec := gob.NewDecoder(r.Body)
var obj interface{}
dec.Decode(&obj) // untrusted request body

Correct

dec := json.NewDecoder(r.Body)
var req CreateUserRequest // strict, expected type
if err := dec.Decode(&req); err != nil {
    http.Error(w, "bad request", 400)
    return
}

Fix

Deserialize untrusted input only into explicitly defined strict types using a data-only format like JSON.